2026 Critical Enterprise Intrusion Chain Detection: Sideloaded Browser Extension manifest.json Dropped by Non-Browser Process

Ibrahim Saud@tektrix

•updated 5 days ago•0•0•0

Detects the creation of a 'manifest.json' file within directory paths containing 'extensions' by a process other than standard web browsers. This behavior is indicative of unauthorized manual installation or modification of browser extensions, which may be used for persistence or to facilitate credential/session theft.